systemd: partially revert hardening

Remove some hardening options introduced with commit a4c991a. Fixes #20.

extras/wg-netns@.service

@@ -14,8 +14,6 @@ RemainAfterExit=yes
 WorkingDirectory=%E/wireguard
 ConfigurationDirectory=wireguard
 ConfigurationDirectoryMode=0700
-ReadOnlyPaths=%E/wireguard
-ReadWritePaths=%E/netns
 
 CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN
 LimitNOFILE=4096
@@ -23,19 +21,8 @@ LimitNPROC=512
 LockPersonality=true
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
-PrivateDevices=true
-PrivateMounts=true
-PrivateTmp=true
-ProcSubset=pid
 ProtectClock=true
-ProtectControlGroups=true
-ProtectHome=true
 ProtectHostname=true
-ProtectKernelLogs=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectProc=noaccess
-ProtectSystem=strict
 RemoveIPC=true
 RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK
 RestrictNamespaces=mnt net